From e435f886b3cb0149c375f67ee9280f1b12a30c02 Mon Sep 17 00:00:00 2001
From: Johann Hofmann <johannhof@chromium.org>
Date: Fri, 28 Aug 2026 18:00:43 +0000
Subject: [PATCH 1/2] Include origin in observation tool map via observed tool
 collection struct

---
 index.bs | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/index.bs b/index.bs
index 241bb2c..a591372 100644
--- a/index.bs
+++ b/index.bs
@@ -1343,7 +1343,17 @@ The [=browser agent=], on the other hand, does not run JavaScript on the page. I
 view of the page's tools and any other relevant context by getting an [=observation=]. An
 <dfn>observation</dfn> is an [=implementation-defined=] data structure containing at least a <dfn
 for=observation>tool map</dfn>, which is a [=map=] whose [=map/keys=] are [=Document/unique ID=]s,
-and whose [=map/values=] are [=lists=] of [=tool definition=] [=structs=].
+and whose [=map/values=] are [=observed tool collection=] [=structs=].
+
+An <dfn>observed tool collection</dfn> is a [=struct=] with the following [=struct/items=]:
+
+<dl dfn-for="observed tool collection">
+  : <dfn>origin</dfn>
+  :: an [=origin=].
+
+  : <dfn>tools</dfn>
+  :: a [=list=] of [=tool definition=] [=structs=].
+</dl>
 
 Note: An [=observation=] is usually a "snapshot" distillation of a page being presented to the user,
 along with any other state the [=user agent=] believes is relevant for the [=browser agent=]; this
@@ -1372,9 +1382,19 @@ steps:
 
      1. Let |id| be |document|'s [=Document/unique ID=].
 
-     1. Set |observation|'s [=observation/tool map=][|id|] = |document|'s [=Document/associated
-        ModelContext|associated <code>ModelContext</code>=]'s [=ModelContext/internal context=]'s
-        [=model context/tool map=]'s [=map/values=], which are [=tool definitions=].
+     1. Let |tools| be |document|'s [=Document/associated ModelContext|associated
+        <code>ModelContext</code>=]'s [=ModelContext/internal context=]'s [=model context/tool
+        map=]'s [=map/values=], which are [=tool definitions=].
+
+     1. Let |observedToolCollection| be a new [=observed tool collection=] with the following [=struct/items=]:
+
+        : [=observed tool collection/origin=]
+        :: |document|'s [=Document/origin=]
+
+        : [=observed tool collection/tools=]
+        :: |tools|
+
+     1. Set |observation|'s [=observation/tool map=][|id|] to |observedToolCollection|.
 
 1. Perform any [=implementation-defined=] steps to add anything to |observation| that the [=user
    agent=] might deem useful or necessary, besides just populating the [=observation/tool map=].

From 4acf64c21d5d3f26864cb4a4245e83072cfe7292 Mon Sep 17 00:00:00 2001
From: Johann Hofmann <johannhof@chromium.org>
Date: Sat, 5 Sep 2026 01:53:42 +0000
Subject: [PATCH 2/2] Move origin note to observed tool collection struct
 definition

---
 index.bs | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/index.bs b/index.bs
index a591372..81cb0ad 100644
--- a/index.bs
+++ b/index.bs
@@ -1351,6 +1351,10 @@ An <dfn>observed tool collection</dfn> is a [=struct=] with the following [=stru
   : <dfn>origin</dfn>
   :: an [=origin=].
 
+     Note: While exposure of tools to the [=browser agent=] is [=implementation-defined=], [=user
+     agents=] are expected to include the origin field to avoid confusion that could be exploited by
+     an attacker.
+
   : <dfn>tools</dfn>
   :: a [=list=] of [=tool definition=] [=structs=].
 </dl>
@@ -1409,11 +1413,6 @@ steps:
      expose tools via Model Context Protocol, other proprietary "function calling" methods, or any
      other way it deems appropriate.
 
-     Advisement: Implementations are expected to convey to the [=browser agent=] any relevant
-     security information associated with [=tool definitions=], such as the originating [=origin=],
-     among other things, so that the backing model has an idea of the different parties at play, and
-     can most safely carry out the end user's intent.
-
 </div>
 
 Each {{Document}} object has a <dfn for=Document>unique ID</dfn>, which is a [=unique internal